# LOGSTASH / Kibana4 - Question **URL:** \ **Category:** Logstash\ **Created:** [September 15, 2015, 9:02pm UTC](https://discuss.elastic.co/t/logstash-kibana4-question/29348 "2015-09-15T21:02:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Luis\_Lacayo](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@Luis\_Lacayo](https://discuss.elastic.co/u/Luis_Lacayo)\ **Post date:** [September 15, 2015, 9:02pm UTC](https://discuss.elastic.co/t/logstash-kibana4-question/29348/1 "2015-09-15T21:02:21Z")
I have a question, I am trying to graph application response times on NGINX logs. I am trying to graph the response time base on a field called request\_duration. My logs look like this: 216.165.152.226 - - [09/Sep/2015:06:54:26 +0000] "GET /cgi-bin/dota/opac-main.pl?logout.x=1 HTTP/1.1" 200 7423 "[https://www.thinktank.info/cgi-bin/dota/acc-main.pl?logout.x=1](https://www.thinktank.info/cgi-bin/dota/acc-main.pl?logout.x=1)" - www.thinktank.info 0.186 10.237.187.132:5013 My filter is this: %{IPORHOST:clientip} %{NGUSER:indent} %{NGUSER:agent} [%{HTTPDATE:timestamp}] "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:answer} %{NUMBER:byte} "%{URI:referrer}" %{NGUSER:indent1} %{JAVACLASS:web1} %{BASE10NUMBER:request\_duration} %{IPORHOST:placksrv}:%{INT:plk\_version} The field that I want to graph is the %{BASE10NUMBER:request\_duration} but if you look in the kinaba index show the field as a string. request\_duration string true true 0 Any Ideas, I am new to the ELK stack and it looks good for our shop. Thanks in advance. BTW also tried this on the filter.. ``` mutate { convert => ["request_duration", "float"] } ``` But no change it still looks like a string in kibana. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 15, 2015, 9:52pm UTC](https://discuss.elastic.co/t/logstash-kibana4-question/29348/2 "2015-09-15T21:52:29Z")
You need to specify that in the template that exists, ES does the best it can but sometimes that's not 100%. Take a look at `curl HOST:9200/_template/logstash`. ---
**Author:** ![Luis\_Lacayo](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@Luis\_Lacayo](https://discuss.elastic.co/u/Luis_Lacayo)\ **Post date:** [September 15, 2015, 10:34pm UTC](https://discuss.elastic.co/t/logstash-kibana4-question/29348/3 "2015-09-15T22:34:51Z")
Mark, Thank you very much for your quick response, however I am not sure I understand what you are asking me to do. curl localhost:9200/\_template/logstash {"logstash":{"order":0,"template":"logstash-_","settings":{"index.refresh\_interval":"5s"},"mappings":{"default":{"dynamic\_templates":[{"string\_fields":{"mapping":{"index":"analyzed","omit\_norms":true,"type":"string","fields":{"raw":{"index":"not\_analyzed","ignore\_above":256,"type":"string"}}},"match\_mapping\_type":"string","match":"_"}}],"properties":{"geoip":{"dynamic":true,"path":"full","properties":{"location":{"type":"geo\_point"}},"type":"object"},"@version":{"index":"not\_analyzed","type":"string"}},"\_all" Do I need to add the field so that it takes effect? Thanks, Luis ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 15, 2015, 10:50pm UTC](https://discuss.elastic.co/t/logstash-kibana4-question/29348/4 "2015-09-15T22:50:00Z")
What does `curl HOST:9200/logstash/_mapping?pretty` show for that `request_duration` field? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [September 15, 2015, 11:54pm UTC](https://discuss.elastic.co/t/logstash-kibana4-question/29348/5 "2015-09-15T23:54:32Z")
You can get the grok filter to convert it from a string to float by changing %{BASE10NUMBER:request\_duration} to %{BASE10NUMBER:request\_duration:float} or by using the mutate filter to convert it as in your example. As you have already indexed the field as a string, you should, as Mark points out, be able to see the field represented as a string in the mappings. As you can not change existing mappings, you will need to either delete your index and reindex your data with the corrected configuration. ---
**Author:** ![Luis\_Lacayo](https://avatars.discourse-cdn.com/v4/letter/l/77aa72/32.png) [@Luis\_Lacayo](https://discuss.elastic.co/u/Luis_Lacayo)\ **Post date:** [September 16, 2015, 3:08am UTC](https://discuss.elastic.co/t/logstash-kibana4-question/29348/6 "2015-09-16T03:08:42Z")
> [@warkolm](#): > > curl HOST:9200/logstash/\_mapping?pretty Mark, Here are the results: ``` "request_duration" : { "type" : "string", "norms" : { "enabled" : false }, "fields" : { "raw" : { "type" : "string", "index" : "not_analyzed", "ignore_above" : 256 } } }, ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 16, 2015, 4:36am UTC](https://discuss.elastic.co/t/logstash-kibana4-question/29348/7 "2015-09-16T04:36:07Z")
Try to do that query on the .raw value then, that should work. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/logstash-kibana4-question/29348/8 "2017-07-06T05:29:02Z")